Ok, so first off, things we are going to need are:
Backtrack 4 r2 Final
Some knowledge
Alright, first off i'd like to explain DNS; What is DNS?
DNS is short for "Domain Name System". Cool, what does it do? The DNS resolves domain names to IP addresses, so for example, let's say Facebook's IP is 14.154.65.109. That's pretty difficult to remember for most people, so we use DNS to resolve facebook.com to 14.154.65.109. So what happens when we type a URL into our browser? It first sends a DNS request to a DNS server, which searches it's database for an IP address registered to the URL we typed and returns the IP address which results in a connection to that IP address. Fun right? Not so much as of yet.
I'm going to show you how to exploit DNS by acting as the DNS server! What does this mean? It means when some one on the network under attack types, for example, http://www.google.com into their URL bar in their browser and requests the DNS for that domain name, that request gets intercepted by us and we return with an IP address of our choice, which they connect to. Sound like fun yet? I think so.
So, hopefully i cleared up a few questions and got some understanding out of you. Let's get started, shall we?
Before we do anything fun, it's usually a good thing to use a fake MAC address. This is the hardware ID of your network card and could be traced back to you.
To change your MAC address, first, bring down your card like this:
Then change your MAC like this:
And then bring your card back up like this:
Alright, so the first thing you're going to want to do is, check your gateways IP address. to check this, open a terminal and type route -n. This is the IP address of the router itself, for mine it is 192.168.1.254.
Once you've done that, you're going to update ettercap's configuration file with the IP you want to redirect traffic to by entering this command into the terminal:
I'm redirecting to a xampp server hosting images of Goatse of which i also have connected to the network.
(I'm redirecting to a xampp server hosting images of Goatse of which i also have connected to the network.)
NOTE: That asterisk(*) means All Traffic and the A means redirected to.
So, if you really wanted, you could change the asterisk to any website you want, for example, any traffic for http://www.facebook.com could be redirected to 192.168.1.65.
When you're done updating ettercap's DNS configuration file, we can run ettercap. Do so like this:
NOTE: my wireless card is wlan0, yours may not be, in order to find out what your card is labeled, run ifconfig in a terminal!
So, if all is done correctly, you should now be able to see all of the websites being redirected to the destination specified by you!
When you feel you want to stop the attack, simply press "q".
I will not be held responsible for any trouble you may get yourself into while doing this.
Backtrack 4 r2 Final
Some knowledge
Alright, first off i'd like to explain DNS; What is DNS?
DNS is short for "Domain Name System". Cool, what does it do? The DNS resolves domain names to IP addresses, so for example, let's say Facebook's IP is 14.154.65.109. That's pretty difficult to remember for most people, so we use DNS to resolve facebook.com to 14.154.65.109. So what happens when we type a URL into our browser? It first sends a DNS request to a DNS server, which searches it's database for an IP address registered to the URL we typed and returns the IP address which results in a connection to that IP address. Fun right? Not so much as of yet.
I'm going to show you how to exploit DNS by acting as the DNS server! What does this mean? It means when some one on the network under attack types, for example, http://www.google.com into their URL bar in their browser and requests the DNS for that domain name, that request gets intercepted by us and we return with an IP address of our choice, which they connect to. Sound like fun yet? I think so.
So, hopefully i cleared up a few questions and got some understanding out of you. Let's get started, shall we?
Before we do anything fun, it's usually a good thing to use a fake MAC address. This is the hardware ID of your network card and could be traced back to you.
To change your MAC address, first, bring down your card like this:
Code
ifconfig wlan0 downCode
macchanger -r wlan0Code
ifconfig wlan0 upAlright, so the first thing you're going to want to do is, check your gateways IP address. to check this, open a terminal and type route -n. This is the IP address of the router itself, for mine it is 192.168.1.254.
Once you've done that, you're going to update ettercap's configuration file with the IP you want to redirect traffic to by entering this command into the terminal:
I'm redirecting to a xampp server hosting images of Goatse of which i also have connected to the network.
Code
sudo echo "* A 192.168.1.65" >> /usr/share/ettercap/etter.dnsNOTE: That asterisk(*) means All Traffic and the A means redirected to.
So, if you really wanted, you could change the asterisk to any website you want, for example, any traffic for http://www.facebook.com could be redirected to 192.168.1.65.
When you're done updating ettercap's DNS configuration file, we can run ettercap. Do so like this:
Code
ettercap -T -q -i wlan0 -M arp:remote /192.168.1.254/ // -P dns_spoofSo, if all is done correctly, you should now be able to see all of the websites being redirected to the destination specified by you!
When you feel you want to stop the attack, simply press "q".
I will not be held responsible for any trouble you may get yourself into while doing this.
![[Image: 83dy0m9HWMFCdD6X702akg.png]](https://wigle.net/bi/83dy0m9HWMFCdD6X702akg.png)